Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1660349 > unrolled thread
| Started by | Willy Tarreau <w@1wt.eu> |
|---|---|
| First post | 2017-06-08 01:10 +0200 |
| Last post | 2017-06-08 06:30 +0200 |
| Articles | 20 on this page of 214 — 3 participants |
Back to article view | Back to linux.kernel
[PATCH 3.10 000/250] 3.10.106-stable review Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200
[PATCH 3.10 188/250] uwb: hwa-rc: fix NULL-deref at probe Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200
[PATCH 3.10 167/250] USB: serial: io_ti: fix NULL-deref in interrupt callback Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200
[PATCH 3.10 136/250] mfd: pm8921: Potential NULL dereference in pm8921_remove() Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200
[PATCH 3.10 099/250] ubifs: Fix journal replay wrt. xattr nodes Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200
[PATCH 3.10 102/250] arm64/ptrace: Reject attempts to set incomplete hardware breakpoint fields Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200
[PATCH 3.10 223/250] Staging: vt6655-6: potential NULL dereference in hostap_disable_hostapd() Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200
[PATCH 3.10 006/250] KVM: x86: Introduce segmented_write_std Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200
[PATCH 3.10 181/250] Input: hanwang - validate number of endpoints before using them Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200
[PATCH 3.10 049/250] USB: serial: io_edgeport: fix NULL-deref at open Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200
[PATCH 3.10 090/250] powerpc/ibmebus: Fix further device reference leaks Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200
[PATCH 3.10 172/250] net: net_enable_timestamp() can be called from irq contexts Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200
[PATCH 3.10 159/250] USB: serial: digi_acceleport: fix OOB data sanity check Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200
[PATCH 3.10 139/250] vti4: Don't count header length twice. Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200
[PATCH 3.10 178/250] net: properly release sk_frag.page Willy Tarreau <w@1wt.eu> - 2017-06-08 01:10 +0200
[PATCH 3.10 229/250] USB: dummy-hcd: fix bug in stop_activity (handle ep0) Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 123/250] packet: fix races in fanout_add() Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 135/250] ocfs2: do not write error flag to user structure we cannot copy from/to Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 107/250] drm/i915: Don't leak edid in intel_crt_detect_ddc() Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 116/250] drm/i915: fix use-after-free in page_flip_completed() Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 202/250] metag/usercopy: Fix alignment error checking Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 236/250] ipv6: fix ip6_tnl_parse_tlv_enc_lim() Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 134/250] goldfish: Sanitize the broken interrupt handler Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 234/250] xc2028: unlock on error in xc2028_set_config() Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 158/250] dm: flush queued bios when process blocks to avoid deadlock Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 013/250] xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 120/250] ip6_gre: fix ip6gre_err() invalid reads Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 160/250] USB: serial: digi_acceleport: fix OOB-event processing Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 217/250] net: phy: handle state correctly in phy_stop_machine Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 062/250] staging: iio: ad7606: fix improper setting of oversampling pins Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 016/250] KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 197/250] USB: OHCI: Fix race between ED unlink and URB submission Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 100/250] arm64/ptrace: Preserve previous registers for short regset write Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 133/250] x86/platform/goldfish: Prevent unconditional loading Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 220/250] ARM: dts: imx31: move CCM device node to AIPS2 bus devices Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 075/250] gro: Enter slow-path if there is no tailroom Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 083/250] USB: serial: ch341: fix open error handling Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 230/250] mm/init: fix zone boundary creation Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 204/250] metag/usercopy: Set flags before ADDZ Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 149/250] scsi: aacraid: Reorder Adapter status check Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 101/250] arm64/ptrace: Avoid uninitialised struct padding in fpr_set() Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 046/250] USB: serial: iuu_phoenix: fix NULL-deref at open Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 026/250] ext4: fix stack memory corruption with 64k block size Willy Tarreau <w@1wt.eu> - 2017-06-08 01:20 +0200
[PATCH 3.10 012/250] xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 201/250] ring-buffer: Fix return value check in test_ringbuffer() Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 091/250] powerpc/ibmebus: Fix device reference leaks in sysfs interface Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 118/250] ipv4: keep skb->dst around in presence of IP options Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 113/250] ARM: 8643/3: arm/ptrace: Preserve previous registers for short regset write Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 020/250] hotplug: Make register and unregister notifier API symmetric Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 156/250] ktest: Fix child exit code processing Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 078/250] powerpc: Fix build warning on 32-bit PPC Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 103/250] ARM: ux500: fix prcmu_is_cpu_in_wfi() calculation Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 060/250] ALSA: usb-audio: Fix bogus error return in snd_usb_create_stream() Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 147/250] MIPS: Handle microMIPS jumps in the same way as MIPS32/MIPS64 jumps Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 036/250] IB/multicast: Check ib_find_pkey() return value Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 073/250] net, sched: fix soft lockup in tc_classify Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 173/250] dccp/tcp: fix routing redirect race Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 087/250] USB: serial: ch341: fix modem-control and B0 handling Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 203/250] metag/usercopy: Add early abort to copy_to_user Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 063/250] usb: dwc3: gadget: always unmap EP0 requests Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 094/250] perf scripting: Avoid leaking the scripting_context variable Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 219/250] MIPS: KGDB: Use kernel context for sleeping threads Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 132/250] USB: serial: ark3116: fix register-accessor error handling Willy Tarreau <w@1wt.eu> - 2017-06-08 01:30 +0200
[PATCH 3.10 130/250] USB: serial: spcp8x5: fix modem-status handling Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 227/250] ping: implement proper locking Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 092/250] IB/mlx4: Set traffic class in AH Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 040/250] USB: serial: quatech2: fix sleep-while-atomic in close Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 187/250] uwb: i1480-dfu: fix NULL-deref at probe Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 242/250] kvm: exclude ioeventfd from counting kvm_io_range limit Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 222/250] tun: Fix TUN_PKT_STRIP setting Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 068/250] scsi: mvsas: fix command_active typo Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 207/250] s390/decompressor: fix initrd corruption caused by bss clear Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 161/250] MIPS: ip27: Disable qlge driver in defconfig Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 104/250] ite-cir: initialize use_demodulator before using it Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 228/250] USB: fix problems with duplicate endpoint addresses Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 143/250] MIPS: Prevent unaligned accesses during stack unwinding Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 208/250] net/mlx4_en: Fix bad WQE issue Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 119/250] netlabel: out of bound access in cipso_v4_validate() Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 065/250] hwmon: (ds620) Fix overflows seen when writing temperature limits Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 162/250] tracing: Add #undef to fix compile error Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 177/250] xen: do not re-use pirq number cached in pci device msi msg data Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 144/250] MIPS: Fix get_frame_info() handling of microMIPS function size Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 237/250] ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim() Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 216/250] netfilter: arp_tables: fix invoking 32bit "iptable -P INPUT ACCEPT" failed in 64bit kernel Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 193/250] ALSA: ctxfi: Fix the incorrect check of dma_set_mask() call Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 206/250] metag/usercopy: Add missing fixups Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 225/250] perf trace: Use the syscall raw_syscalls:sys_enter timestamp Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 072/250] ser_gigaset: return -ENOMEM on error instead of success Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 051/250] USB: serial: cyberjack: fix NULL-deref at open Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 155/250] IB/ipoib: Fix deadlock between rmmod and set_mode Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 175/250] perf/core: Fix event inheritance on fork() Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 211/250] powerpc: Disable HFSCR[TM] if TM is not supported Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 192/250] ALSA: ctxfi: Fallback DMA mask to 32bit Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 232/250] Drivers: hv: avoid vfree() on crash Willy Tarreau <w@1wt.eu> - 2017-06-08 01:40 +0200
[PATCH 3.10 249/250] dccp/tcp: do not inherit mc_list from parent Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 033/250] scsi: zfcp: fix rport unblock race with LUN recovery Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 171/250] locking/static_keys: Add static_key_{en,dis}able() helpers Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 096/250] svcrpc: don't leak contexts on PROC_DESTROY Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 055/250] USB: serial: mos7720: fix use-after-free on probe errors Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 125/250] net: socket: fix recvmmsg not returning error from sock_error Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 039/250] USB: serial: omninet: fix NULL-derefs at open and disconnect Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 117/250] net: use a work queue to defer net_disable_timestamp() work Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 077/250] gro: Disable frag0 optimization on IPv6 ext headers Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 064/250] cris: Only build flash rescue image if CONFIG_ETRAX_AXISFLASHMAP is selected Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 110/250] net: fix harmonize_features() vs NETIF_F_HIGHDMA Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 180/250] Input: ims-pcu - validate number of endpoints before using them Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 244/250] TTY: n_hdlc, fix lockdep false positive Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 235/250] xc2028: Fix use-after-free bug properly Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 148/250] uvcvideo: Fix a wrong macro Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 004/250] libceph: don't set weight to IN when OSD is destroyed Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 200/250] ptrace: fix PTRACE_LISTEN race corrupting task->state Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 250/250] char: lp: fix possible integer overflow in lp_setup() Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 239/250] sctp: avoid BUG_ON on sctp_wait_for_sndbuf Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 080/250] mm/hugetlb.c: fix reservation race when freeing surplus pages Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 041/250] USB: serial: pl2303: fix NULL-deref at open Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 168/250] USB: serial: io_ti: fix information leak in completion handler Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 233/250] xc2028: avoid use after free Willy Tarreau <w@1wt.eu> - 2017-06-08 01:50 +0200
[PATCH 3.10 122/250] l2tp: do not use udp_ioctl() Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 146/250] MIPS: Calculate microMIPS ra properly when unwinding the stack Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 048/250] USB: serial: ti_usb_3410_5052: fix NULL-deref at open Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 231/250] can: Fix kernel panic at security_sock_rcv_skb Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 182/250] Input: yealink - validate number of endpoints before using them Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 183/250] Input: cm109 - validate number of endpoints before using them Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 240/250] sctp: deny peeloff operation on asocs with threads sleeping on it Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 176/250] isdn/gigaset: fix NULL-deref at probe Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 052/250] USB: serial: kobil_sct: fix NULL-deref in write Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 153/250] NFSv4: fix getacl head length estimation Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 082/250] USB: serial: ch341: fix initial modem-control state Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 190/250] ext4: mark inode dirty after converting inline directory Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 086/250] USB: serial: ch341: fix resume after reset Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 127/250] USB: serial: ftdi_sio: fix modem-status error handling Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 218/250] l2tp: take reference on sessions being dumped Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 015/250] KEYS: Change the name of the dead type to ".dead" to prevent user access Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 198/250] i2c: at91: manage unexpected RXRDY flag when starting a transfer Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 021/250] Btrfs: fix tree search logic when replaying directory entry deletes Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 034/250] ftrace/x86_32: Set ftrace_stub to weak to prevent gcc from using short jumps to it Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 184/250] USB: uss720: fix NULL-deref at probe Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 005/250] KVM: x86: fix emulation of "MOV SS, null selector" Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 151/250] fuse: add missing FR_FORCE Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 154/250] s390/qdio: clear DSCI prior to scanning multiple input queues Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 224/250] net: sctp: rework multihoming retransmission path selection to rfc4960 Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 247/250] fs: exec: apply CLOEXEC before changing dumpable task flags Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 191/250] scsi: libsas: fix ata xfer length Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 032/250] scsi: zfcp: do not trace pure benign residual HBA responses at default level Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 088/250] x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 189/250] mmc: ushc: fix NULL-deref at probe Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 141/250] MIPS: OCTEON: Fix copy_from_user fault handling for large buffers Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 108/250] s5k4ecgx: select CRC32 helper Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 150/250] ath9k: use correct OTP register offsets for the AR9340 and AR9550 Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 124/250] packet: Do not call fanout_release from atomic contexts Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 152/250] RDMA/core: Fix incorrect structure packing for booleans Willy Tarreau <w@1wt.eu> - 2017-06-08 02:00 +0200
[PATCH 3.10 076/250] gro: use min_t() in skb_gro_reset_offset() Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 105/250] fuse: do not use iocb after it may have been freed Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 245/250] tty: n_hdlc: get rid of racy n_hdlc.tbuf Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 067/250] iommu/amd: Fix the left value check of cmd buffer Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 164/250] USB: serial: omninet: fix reference leaks at open Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 140/250] net/sched: em_meta: Fix 'meta vlan' to correctly recognize zero VID frames Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 029/250] f2fs: set ->owner for debugfs status file's file_operations Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 058/250] usb: xhci-mem: use passed in GFP flags instead of GFP_KERNEL Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 031/250] scsi: zfcp: fix use-after-"free" in FC ingress path after TMF Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 023/250] block_dev: don't test bdev->bd_contains when it is not stable Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 157/250] nlm: Ensure callback code also checks that the files match Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 089/250] NFSv4.1: nfs4_fl_prepare_ds must be careful about reporting success. Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 209/250] net/mlx4_core: Fix racy CQ (Completion Queue) free Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 112/250] svcrpc: fix oops in absence of krb5 module Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
Re: [PATCH 3.10 112/250] svcrpc: fix oops in absence of krb5 module Simo Sorce <simo@redhat.com> - 2017-06-08 10:20 +0200
[PATCH 3.10 114/250] mac80211: Fix adding of mesh vendor IEs Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 246/250] ipv6: handle -EFAULT from skb_copy_bits Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 138/250] net: 6lowpan: fix lowpan_header_create non-compression memcpy call Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 059/250] usb: musb: Fix trying to free already-free IRQ 4 Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 137/250] drm/nv50/disp: min/max are reversed in nv50_crtc_gamma_set() Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 097/250] mmc: mxs-mmc: Fix additional cycles after transmission stop Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 205/250] metag/usercopy: Fix src fixup in from user rapf loops Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 165/250] USB: iowarrior: fix NULL-deref at probe Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 131/250] USB: serial: opticon: fix CTS retrieval at open Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 215/250] ring-buffer: Have ring_buffer_iter_empty() return true when empty Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 098/250] mtd: nand: xway: disable module support Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 044/250] USB: serial: io_ti: fix NULL-deref at open Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 212/250] pegasus: Use heap buffers for all register access Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 214/250] tracing: Allocate the snapshot buffer before enabling probe Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 106/250] crypto: caam - fix non-hmac hashes Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 169/250] vxlan: correctly validate VXLAN ID against VXLAN_N_VID Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 002/250] crypto: crypto_memneq - add equality testing of memory regions w/o timing leaks Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 071/250] powerpc/pci/rpadlpar: Fix device reference leaks Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 194/250] ACPI / PNP: Avoid conflicting resource reservations Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 047/250] USB: serial: garmin_gps: fix memory leak on failed URB submit Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 018/250] locking/rtmutex: Prevent dequeue vs. unlock race Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 195/250] ACPI / resources: free memory on error in add_region_before() Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 179/250] net: unix: properly re-increment inflight counter of GC discarded candidates Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 054/250] USB: serial: mos7720: fix NULL-deref at open Willy Tarreau <w@1wt.eu> - 2017-06-08 02:10 +0200
[PATCH 3.10 074/250] net: stmmac: Fix race between stmmac_drv_probe and stmmac_open Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 042/250] USB: serial: keyspan_pda: verify endpoints at probe Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 028/250] ext4: return -ENOMEM instead of success Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 038/250] usb: gadget: composite: Test get_alt() presence instead of set_alt() Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 017/250] ext4: fix data exposure after a crash Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 025/250] ext4: fix mballoc breakage with 64k block size Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 030/250] block: protect iterate_bdevs() against concurrent close Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 111/250] tcp: initialize max window for a new fastopen socket Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 009/250] fbdev: color map copying bounds checking Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 126/250] USB: serial: mos7840: fix another NULL-deref at open Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 035/250] IB/mad: Fix an array index check Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 050/250] USB: serial: oti6858: fix NULL-deref at open Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 001/250] packet: fix race condition in packet_set_ring Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 081/250] USB: serial: kl5kusb105: fix line-state error handling Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 079/250] Input: i8042 - add Pegatron touchpad to noloop table Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 037/250] powerpc: Convert cmp to cmpd in idle enter sequence Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 061/250] USB: serial: kl5kusb105: abort on open exception path Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 024/250] crypto: caam - fix AEAD givenc descriptors Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 010/250] selinux: fix off-by-one in setprocattr Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 043/250] USB: serial: spcp8x5: fix NULL-deref at open Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 142/250] MIPS: Clear ISA bit correctly in get_frame_info() Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
[PATCH 3.10 019/250] m68k: Fix ndelay() macro Willy Tarreau <w@1wt.eu> - 2017-06-08 02:20 +0200
Re: [PATCH 3.10 000/250] 3.10.106-stable review Guenter Roeck <linux@roeck-us.net> - 2017-06-08 02:40 +0200
Re: [PATCH 3.10 000/250] 3.10.106-stable review Willy Tarreau <w@1wt.eu> - 2017-06-08 06:30 +0200
Page 5 of 11 — ← Prev page 1 … 3 4 [5] 6 7 … 11 Next page →
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:40 +0200 |
| Subject | [PATCH 3.10 177/250] xen: do not re-use pirq number cached in pci device msi msg data |
| Message-ID | <tPSIs-4Pr-53@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Dan Streetman <ddstreet@ieee.org>
commit c74fd80f2f41d05f350bb478151021f88551afe8 upstream.
Revert the main part of commit:
af42b8d12f8a ("xen: fix MSI setup and teardown for PV on HVM guests")
That commit introduced reading the pci device's msi message data to see
if a pirq was previously configured for the device's msi/msix, and re-use
that pirq. At the time, that was the correct behavior. However, a
later change to Qemu caused it to call into the Xen hypervisor to unmap
all pirqs for a pci device, when the pci device disables its MSI/MSIX
vectors; specifically the Qemu commit:
c976437c7dba9c7444fb41df45468968aaa326ad
("qemu-xen: free all the pirqs for msi/msix when driver unload")
Once Qemu added this pirq unmapping, it was no longer correct for the
kernel to re-use the pirq number cached in the pci device msi message
data. All Qemu releases since 2.1.0 contain the patch that unmaps the
pirqs when the pci device disables its MSI/MSIX vectors.
This bug is causing failures to initialize multiple NVMe controllers
under Xen, because the NVMe driver sets up a single MSIX vector for
each controller (concurrently), and then after using that to talk to
the controller for some configuration data, it disables the single MSIX
vector and re-configures all the MSIX vectors it needs. So the MSIX
setup code tries to re-use the cached pirq from the first vector
for each controller, but the hypervisor has already given away that
pirq to another controller, and its initialization fails.
This is discussed in more detail at:
https://lists.xen.org/archives/html/xen-devel/2017-01/msg00447.html
Fixes: af42b8d12f8a ("xen: fix MSI setup and teardown for PV on HVM guests")
Signed-off-by: Dan Streetman <dan.streetman@canonical.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
arch/x86/pci/xen.c | 23 +++++++----------------
1 file changed, 7 insertions(+), 16 deletions(-)
diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c
index 48e8461..6e4580b 100644
--- a/arch/x86/pci/xen.c
+++ b/arch/x86/pci/xen.c
@@ -227,23 +227,14 @@ static int xen_hvm_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
return 1;
list_for_each_entry(msidesc, &dev->msi_list, list) {
- __read_msi_msg(msidesc, &msg);
- pirq = MSI_ADDR_EXT_DEST_ID(msg.address_hi) |
- ((msg.address_lo >> MSI_ADDR_DEST_ID_SHIFT) & 0xff);
- if (msg.data != XEN_PIRQ_MSI_DATA ||
- xen_irq_from_pirq(pirq) < 0) {
- pirq = xen_allocate_pirq_msi(dev, msidesc);
- if (pirq < 0) {
- irq = -ENODEV;
- goto error;
- }
- xen_msi_compose_msg(dev, pirq, &msg);
- __write_msi_msg(msidesc, &msg);
- dev_dbg(&dev->dev, "xen: msi bound to pirq=%d\n", pirq);
- } else {
- dev_dbg(&dev->dev,
- "xen: msi already bound to pirq=%d\n", pirq);
+ pirq = xen_allocate_pirq_msi(dev, msidesc);
+ if (pirq < 0) {
+ irq = -ENODEV;
+ goto error;
}
+ xen_msi_compose_msg(dev, pirq, &msg);
+ __write_msi_msg(msidesc, &msg);
+ dev_dbg(&dev->dev, "xen: msi bound to pirq=%d\n", pirq);
irq = xen_bind_pirq_msi_to_irq(dev, msidesc, pirq,
(type == PCI_CAP_ID_MSIX) ?
"msi-x" : "msi",
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:40 +0200 |
| Subject | [PATCH 3.10 144/250] MIPS: Fix get_frame_info() handling of microMIPS function size |
| Message-ID | <tPSIs-4Pr-59@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Paul Burton <paul.burton@imgtec.com>
commit b6c7a324df37bf05ef7a2c1580683cf10d082d97 upstream.
get_frame_info() is meant to iterate over up to the first 128
instructions within a function, but for microMIPS kernels it will not
reach that many instructions unless the function is 512 bytes long since
we calculate the maximum number of instructions to check by dividing the
function length by the 4 byte size of a union mips_instruction. In
microMIPS kernels this won't do since instructions are variable length.
Fix this by instead checking whether the pointer to the current
instruction has reached the end of the function, and use max_insns as a
simple constant to check the number of iterations against.
Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Fixes: 34c2f668d0f6 ("MIPS: microMIPS: Add unaligned access support.")
Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/14530/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
arch/mips/kernel/process.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 71110b9..e67e17a 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -312,9 +312,9 @@ static inline int is_sp_move_ins(union mips_instruction *ip)
static int get_frame_info(struct mips_frame_info *info)
{
bool is_mmips = IS_ENABLED(CONFIG_CPU_MICROMIPS);
- union mips_instruction insn, *ip;
- unsigned max_insns = info->func_size / sizeof(union mips_instruction);
- unsigned i;
+ union mips_instruction insn, *ip, *ip_end;
+ const unsigned int max_insns = 128;
+ unsigned int i;
info->pc_offset = -1;
info->frame_size = 0;
@@ -323,11 +323,9 @@ static int get_frame_info(struct mips_frame_info *info)
if (!ip)
goto err;
- if (max_insns == 0)
- max_insns = 128U; /* unknown function size */
- max_insns = min(128U, max_insns);
+ ip_end = (void *)ip + info->func_size;
- for (i = 0; i < max_insns; i++, ip++) {
+ for (i = 0; i < max_insns && ip < ip_end; i++, ip++) {
if (is_mmips && mm_insn_16bit(ip->halfword[0])) {
insn.halfword[0] = 0;
insn.halfword[1] = ip->halfword[0];
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:40 +0200 |
| Subject | [PATCH 3.10 237/250] ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim() |
| Message-ID | <tPSIs-4Pr-55@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 63117f09c768be05a0bf465911297dc76394f686 upstream.
Casting is a high precedence operation but "off" and "i" are in terms of
bytes so we need to have some parenthesis here.
Fixes: fbfa743a9d2a ("ipv6: fix ip6_tnl_parse_tlv_enc_lim()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
net/ipv6/ip6_tunnel.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 33bf1c1..61a8995 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -435,7 +435,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
if (i + sizeof(*tel) > optlen)
break;
- tel = (struct ipv6_tlv_tnl_enc_lim *) skb->data + off + i;
+ tel = (struct ipv6_tlv_tnl_enc_lim *)(skb->data + off + i);
/* return index of option if found and valid */
if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
tel->length == 1)
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:40 +0200 |
| Subject | [PATCH 3.10 216/250] netfilter: arp_tables: fix invoking 32bit "iptable -P INPUT ACCEPT" failed in 64bit kernel |
| Message-ID | <tPSIs-4Pr-63@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Hongxu Jia <hongxu.jia@windriver.com>
commit 17a49cd549d9dc8707dc9262210166455c612dde upstream.
Since 09d9686047db ("netfilter: x_tables: do compat validation via
translate_table"), it used compatr structure to assign newinfo
structure. In translate_compat_table of ip_tables.c and ip6_tables.c,
it used compatr->hook_entry to replace info->hook_entry and
compatr->underflow to replace info->underflow, but not do the same
replacement in arp_tables.c.
It caused invoking 32-bit "arptbale -P INPUT ACCEPT" failed in 64bit
kernel.
--------------------------------------
root@qemux86-64:~# arptables -P INPUT ACCEPT
root@qemux86-64:~# arptables -P INPUT ACCEPT
ERROR: Policy for `INPUT' offset 448 != underflow 0
arptables: Incompatible with this kernel
--------------------------------------
Fixes: 09d9686047db ("netfilter: x_tables: do compat validation via translate_table")
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
net/ipv4/netfilter/arp_tables.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 95a5f26..f8f05187 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1309,8 +1309,8 @@ static int translate_compat_table(struct xt_table_info **pinfo,
newinfo->number = compatr->num_entries;
for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
- newinfo->hook_entry[i] = info->hook_entry[i];
- newinfo->underflow[i] = info->underflow[i];
+ newinfo->hook_entry[i] = compatr->hook_entry[i];
+ newinfo->underflow[i] = compatr->underflow[i];
}
entry1 = newinfo->entries[raw_smp_processor_id()];
pos = entry1;
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:40 +0200 |
| Subject | [PATCH 3.10 193/250] ALSA: ctxfi: Fix the incorrect check of dma_set_mask() call |
| Message-ID | <tPSIs-4Pr-65@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Takashi Iwai <tiwai@suse.de>
commit f363a06642f28caaa78cb6446bbad90c73fe183c upstream.
In the commit [15c75b09f8d1: ALSA: ctxfi: Fallback DMA mask to 32bit],
I forgot to put "!" at dam_set_mask() call check in cthw20k1.c (while
cthw20k2.c is OK). This patch fixes that obvious bug.
(As a side note: although the original commit was completely wrong,
it's still working for most of machines, as it sets to 32bit DMA mask
in the end. So the bug severity is low.)
Fixes: 15c75b09f8d1 ("ALSA: ctxfi: Fallback DMA mask to 32bit")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
sound/pci/ctxfi/cthw20k1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/pci/ctxfi/cthw20k1.c b/sound/pci/ctxfi/cthw20k1.c
index abd0a2d..7f414b0 100644
--- a/sound/pci/ctxfi/cthw20k1.c
+++ b/sound/pci/ctxfi/cthw20k1.c
@@ -1904,7 +1904,7 @@ static int hw_card_start(struct hw *hw)
return err;
/* Set DMA transfer mask */
- if (dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
+ if (!dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits));
} else {
dma_set_mask(&pci->dev, DMA_BIT_MASK(32));
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:40 +0200 |
| Subject | [PATCH 3.10 206/250] metag/usercopy: Add missing fixups |
| Message-ID | <tPSIs-4Pr-61@gated-at.bofh.it> |
| In reply to | #1660349 |
From: James Hogan <james.hogan@imgtec.com>
commit b884a190afcecdbef34ca508ea5ee88bb7c77861 upstream.
The rapf copy loops in the Meta usercopy code is missing some extable
entries for HTP cores with unaligned access checking enabled, where
faults occur on the instruction immediately after the faulting access.
Add the fixup labels and extable entries for these cases so that corner
case user copy failures don't cause kernel crashes.
Fixes: 373cd784d0fc ("metag: Memory handling")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-metag@vger.kernel.org
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
arch/metag/lib/usercopy.c | 72 +++++++++++++++++++++++++++++++----------------
1 file changed, 48 insertions(+), 24 deletions(-)
diff --git a/arch/metag/lib/usercopy.c b/arch/metag/lib/usercopy.c
index 4adbab2..dfe77b2 100644
--- a/arch/metag/lib/usercopy.c
+++ b/arch/metag/lib/usercopy.c
@@ -260,27 +260,31 @@
"MGETL D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \
"22:\n" \
"MSETL [%0++], D0FrT, D0.5, D0.6, D0.7\n" \
- "SUB %3, %3, #32\n" \
"23:\n" \
- "MGETL D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \
+ "SUB %3, %3, #32\n" \
"24:\n" \
+ "MGETL D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \
+ "25:\n" \
"MSETL [%0++], D0FrT, D0.5, D0.6, D0.7\n" \
+ "26:\n" \
"SUB %3, %3, #32\n" \
"DCACHE [%1+#-64], D0Ar6\n" \
"BR $Lloop"id"\n" \
\
"MOV RAPF, %1\n" \
- "25:\n" \
+ "27:\n" \
"MGETL D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \
- "26:\n" \
+ "28:\n" \
"MSETL [%0++], D0FrT, D0.5, D0.6, D0.7\n" \
+ "29:\n" \
"SUB %3, %3, #32\n" \
- "27:\n" \
+ "30:\n" \
"MGETL D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \
- "28:\n" \
+ "31:\n" \
"MSETL [%0++], D0FrT, D0.5, D0.6, D0.7\n" \
+ "32:\n" \
"SUB %0, %0, #8\n" \
- "29:\n" \
+ "33:\n" \
"SETL [%0++], D0.7, D1.7\n" \
"SUB %3, %3, #32\n" \
"1:" \
@@ -312,7 +316,11 @@
" .long 26b,3b\n" \
" .long 27b,3b\n" \
" .long 28b,3b\n" \
- " .long 29b,4b\n" \
+ " .long 29b,3b\n" \
+ " .long 30b,3b\n" \
+ " .long 31b,3b\n" \
+ " .long 32b,3b\n" \
+ " .long 33b,4b\n" \
" .previous\n" \
: "=r" (to), "=r" (from), "=r" (ret), "=d" (n) \
: "0" (to), "1" (from), "2" (ret), "3" (n) \
@@ -403,47 +411,55 @@
"MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \
"22:\n" \
"MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \
- "SUB %3, %3, #16\n" \
"23:\n" \
- "MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \
- "24:\n" \
- "MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \
"SUB %3, %3, #16\n" \
- "25:\n" \
+ "24:\n" \
"MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \
- "26:\n" \
+ "25:\n" \
"MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \
+ "26:\n" \
"SUB %3, %3, #16\n" \
"27:\n" \
"MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \
"28:\n" \
"MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \
+ "29:\n" \
+ "SUB %3, %3, #16\n" \
+ "30:\n" \
+ "MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \
+ "31:\n" \
+ "MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \
+ "32:\n" \
"SUB %3, %3, #16\n" \
"DCACHE [%1+#-64], D0Ar6\n" \
"BR $Lloop"id"\n" \
\
"MOV RAPF, %1\n" \
- "29:\n" \
+ "33:\n" \
"MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \
- "30:\n" \
+ "34:\n" \
"MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \
+ "35:\n" \
"SUB %3, %3, #16\n" \
- "31:\n" \
+ "36:\n" \
"MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \
- "32:\n" \
+ "37:\n" \
"MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \
+ "38:\n" \
"SUB %3, %3, #16\n" \
- "33:\n" \
+ "39:\n" \
"MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \
- "34:\n" \
+ "40:\n" \
"MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \
+ "41:\n" \
"SUB %3, %3, #16\n" \
- "35:\n" \
+ "42:\n" \
"MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \
- "36:\n" \
+ "43:\n" \
"MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \
+ "44:\n" \
"SUB %0, %0, #4\n" \
- "37:\n" \
+ "45:\n" \
"SETD [%0++], D0.7\n" \
"SUB %3, %3, #16\n" \
"1:" \
@@ -483,7 +499,15 @@
" .long 34b,3b\n" \
" .long 35b,3b\n" \
" .long 36b,3b\n" \
- " .long 37b,4b\n" \
+ " .long 37b,3b\n" \
+ " .long 38b,3b\n" \
+ " .long 39b,3b\n" \
+ " .long 40b,3b\n" \
+ " .long 41b,3b\n" \
+ " .long 42b,3b\n" \
+ " .long 43b,3b\n" \
+ " .long 44b,3b\n" \
+ " .long 45b,4b\n" \
" .previous\n" \
: "=r" (to), "=r" (from), "=r" (ret), "=d" (n) \
: "0" (to), "1" (from), "2" (ret), "3" (n) \
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:40 +0200 |
| Subject | [PATCH 3.10 225/250] perf trace: Use the syscall raw_syscalls:sys_enter timestamp |
| Message-ID | <tPSIs-4Pr-67@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Arnaldo Carvalho de Melo <acme@redhat.com>
commit ecf1e2253ea79c6204f4d6a5e756e8fb4aed5a7e upstream.
Instead of the one when another syscall takes place while another is being
processed (in another CPU, but we show it serialized, so need to "interrupt"
the other), and also when finally showing the sys_enter + sys_exit + duration,
where we were showing the sample->time for the sys_exit, duh.
Before:
# perf trace sleep 1
<SNIP>
0.373 ( 0.001 ms): close(fd: 3 ) = 0
1000.626 (1000.211 ms): nanosleep(rqtp: 0x7ffd6ddddfb0) = 0
1000.653 ( 0.003 ms): close(fd: 1 ) = 0
1000.657 ( 0.002 ms): close(fd: 2 ) = 0
1000.667 ( 0.000 ms): exit_group( )
#
After:
# perf trace sleep 1
<SNIP>
0.336 ( 0.001 ms): close(fd: 3 ) = 0
0.373 (1000.086 ms): nanosleep(rqtp: 0x7ffe303e9550) = 0
1000.481 ( 0.002 ms): close(fd: 1 ) = 0
1000.485 ( 0.001 ms): close(fd: 2 ) = 0
1000.494 ( 0.000 ms): exit_group( )
[root@jouet linux]#
[js] no trace__printf_interrupted_entry in 3.12 yet
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: http://lkml.kernel.org/n/tip-ecbzgmu2ni6glc6zkw8p1zmx@git.kernel.org
Fixes: 752fde44fd1c ("perf trace: Support interrupted syscalls")
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
[wt: 3.10 uses stdout instead of trace->output ;
no trace__printf_interrupted_entry() function ]
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
tools/perf/builtin-trace.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index ab3ed4a..9f2afbd 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -330,7 +330,7 @@ static int trace__sys_enter(struct trace *trace, struct perf_evsel *evsel,
if (!strcmp(sc->name, "exit_group") || !strcmp(sc->name, "exit")) {
if (!trace->duration_filter) {
- trace__fprintf_entry_head(trace, thread, 1, sample->time, stdout);
+ trace__fprintf_entry_head(trace, thread, 1, ttrace->entry_time, stdout);
printf("%-70s\n", ttrace->entry_str);
}
} else
@@ -364,7 +364,7 @@ static int trace__sys_exit(struct trace *trace, struct perf_evsel *evsel,
} else if (trace->duration_filter)
goto out;
- trace__fprintf_entry_head(trace, thread, duration, sample->time, stdout);
+ trace__fprintf_entry_head(trace, thread, duration, ttrace->entry_time, stdout);
if (ttrace->entry_pending) {
printf("%-70s", ttrace->entry_str);
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:40 +0200 |
| Subject | [PATCH 3.10 072/250] ser_gigaset: return -ENOMEM on error instead of success |
| Message-ID | <tPSIs-4Pr-69@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 93a97c50cbf1c007caf12db5cc23e0d5b9c8473c upstream.
If we can't allocate the resources in gigaset_initdriver() then we
should return -ENOMEM instead of zero.
Fixes: 2869b23e4b95 ("[PATCH] drivers/isdn/gigaset: new M101 driver (v2)")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
drivers/isdn/gigaset/ser-gigaset.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
index 3ac9c41..53dfe16 100644
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -787,8 +787,10 @@ static int __init ser_gigaset_init(void)
driver = gigaset_initdriver(GIGASET_MINOR, GIGASET_MINORS,
GIGASET_MODULENAME, GIGASET_DEVNAME,
&ops, THIS_MODULE);
- if (!driver)
+ if (!driver) {
+ rc = -ENOMEM;
goto error;
+ }
rc = tty_register_ldisc(N_GIGASET_M101, &gigaset_ldisc);
if (rc != 0) {
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:40 +0200 |
| Subject | [PATCH 3.10 051/250] USB: serial: cyberjack: fix NULL-deref at open |
| Message-ID | <tPSIs-4Pr-71@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Johan Hovold <johan@kernel.org>
commit 3dca01114dcecb1cf324534cd8d75fd1306a516b upstream.
Fix NULL-pointer dereference when clearing halt at open should the device
lack a bulk-out endpoint.
Unable to handle kernel NULL pointer dereference at virtual address 00000030
...
PC is at cyberjack_open+0x40/0x9c [cyberjack]
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
drivers/usb/serial/cyberjack.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
index 7814262..bb3c7f0 100644
--- a/drivers/usb/serial/cyberjack.c
+++ b/drivers/usb/serial/cyberjack.c
@@ -51,6 +51,7 @@
#define CYBERJACK_PRODUCT_ID 0x0100
/* Function prototypes */
+static int cyberjack_attach(struct usb_serial *serial);
static int cyberjack_port_probe(struct usb_serial_port *port);
static int cyberjack_port_remove(struct usb_serial_port *port);
static int cyberjack_open(struct tty_struct *tty,
@@ -78,6 +79,7 @@ static struct usb_serial_driver cyberjack_device = {
.description = "Reiner SCT Cyberjack USB card reader",
.id_table = id_table,
.num_ports = 1,
+ .attach = cyberjack_attach,
.port_probe = cyberjack_port_probe,
.port_remove = cyberjack_port_remove,
.open = cyberjack_open,
@@ -101,6 +103,14 @@ struct cyberjack_private {
short wrsent; /* Data already sent */
};
+static int cyberjack_attach(struct usb_serial *serial)
+{
+ if (serial->num_bulk_out < serial->num_ports)
+ return -ENODEV;
+
+ return 0;
+}
+
static int cyberjack_port_probe(struct usb_serial_port *port)
{
struct cyberjack_private *priv;
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:40 +0200 |
| Subject | [PATCH 3.10 155/250] IB/ipoib: Fix deadlock between rmmod and set_mode |
| Message-ID | <tPSIt-4Pr-75@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Feras Daoud <ferasda@mellanox.com>
commit 0a0007f28304cb9fc87809c86abb80ec71317f20 upstream.
When calling set_mode from sys/fs, the call flow locks the sys/fs lock
first and then tries to lock rtnl_lock (when calling ipoib_set_mod).
On the other hand, the rmmod call flow takes the rtnl_lock first
(when calling unregister_netdev) and then tries to take the sys/fs
lock. Deadlock a->b, b->a.
The problem starts when ipoib_set_mod frees it's rtnl_lck and tries
to get it after that.
set_mod:
[<ffffffff8104f2bd>] ? check_preempt_curr+0x6d/0x90
[<ffffffff814fee8e>] __mutex_lock_slowpath+0x13e/0x180
[<ffffffff81448655>] ? __rtnl_unlock+0x15/0x20
[<ffffffff814fed2b>] mutex_lock+0x2b/0x50
[<ffffffff81448675>] rtnl_lock+0x15/0x20
[<ffffffffa02ad807>] ipoib_set_mode+0x97/0x160 [ib_ipoib]
[<ffffffffa02b5f5b>] set_mode+0x3b/0x80 [ib_ipoib]
[<ffffffff8134b840>] dev_attr_store+0x20/0x30
[<ffffffff811f0fe5>] sysfs_write_file+0xe5/0x170
[<ffffffff8117b068>] vfs_write+0xb8/0x1a0
[<ffffffff8117ba81>] sys_write+0x51/0x90
[<ffffffff8100b0f2>] system_call_fastpath+0x16/0x1b
rmmod:
[<ffffffff81279ffc>] ? put_dec+0x10c/0x110
[<ffffffff8127a2ee>] ? number+0x2ee/0x320
[<ffffffff814fe6a5>] schedule_timeout+0x215/0x2e0
[<ffffffff8127cc04>] ? vsnprintf+0x484/0x5f0
[<ffffffff8127b550>] ? string+0x40/0x100
[<ffffffff814fe323>] wait_for_common+0x123/0x180
[<ffffffff81060250>] ? default_wake_function+0x0/0x20
[<ffffffff8119661e>] ? ifind_fast+0x5e/0xb0
[<ffffffff814fe43d>] wait_for_completion+0x1d/0x20
[<ffffffff811f2e68>] sysfs_addrm_finish+0x228/0x270
[<ffffffff811f2fb3>] sysfs_remove_dir+0xa3/0xf0
[<ffffffff81273f66>] kobject_del+0x16/0x40
[<ffffffff8134cd14>] device_del+0x184/0x1e0
[<ffffffff8144e59b>] netdev_unregister_kobject+0xab/0xc0
[<ffffffff8143c05e>] rollback_registered+0xae/0x130
[<ffffffff8143c102>] unregister_netdevice+0x22/0x70
[<ffffffff8143c16e>] unregister_netdev+0x1e/0x30
[<ffffffffa02a91b0>] ipoib_remove_one+0xe0/0x120 [ib_ipoib]
[<ffffffffa01ed95f>] ib_unregister_device+0x4f/0x100 [ib_core]
[<ffffffffa021f5e1>] mlx4_ib_remove+0x41/0x180 [mlx4_ib]
[<ffffffffa01ab771>] mlx4_remove_device+0x71/0x90 [mlx4_core]
Fixes: 862096a8bbf8 ("IB/ipoib: Add more rtnl_link_ops callbacks")
Cc: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Feras Daoud <ferasda@mellanox.com>
Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
drivers/infiniband/ulp/ipoib/ipoib_cm.c | 12 +++++++-----
drivers/infiniband/ulp/ipoib/ipoib_main.c | 6 ++----
2 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index aa9ad2d..c781c7c 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1482,12 +1482,14 @@ static ssize_t set_mode(struct device *d, struct device_attribute *attr,
ret = ipoib_set_mode(dev, buf);
- rtnl_unlock();
-
- if (!ret)
- return count;
+ /* The assumption is that the function ipoib_set_mode returned
+ * with the rtnl held by it, if not the value -EBUSY returned,
+ * then no need to rtnl_unlock
+ */
+ if (ret != -EBUSY)
+ rtnl_unlock();
- return ret;
+ return (!ret || ret == -EBUSY) ? count : ret;
}
static DEVICE_ATTR(mode, S_IWUSR | S_IRUGO, show_mode, set_mode);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 375f9ed..b022d71 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -234,8 +234,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
priv->tx_wr.send_flags &= ~IB_SEND_IP_CSUM;
ipoib_flush_paths(dev);
- rtnl_lock();
- return 0;
+ return (!rtnl_trylock()) ? -EBUSY : 0;
}
if (!strcmp(buf, "datagram\n")) {
@@ -244,8 +243,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
dev_set_mtu(dev, min(priv->mcast_mtu, dev->mtu));
rtnl_unlock();
ipoib_flush_paths(dev);
- rtnl_lock();
- return 0;
+ return (!rtnl_trylock()) ? -EBUSY : 0;
}
return -EINVAL;
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:40 +0200 |
| Subject | [PATCH 3.10 175/250] perf/core: Fix event inheritance on fork() |
| Message-ID | <tPSIt-4Pr-77@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Peter Zijlstra <peterz@infradead.org>
commit e7cc4865f0f31698ef2f7aac01a50e78968985b7 upstream.
While hunting for clues to a use-after-free, Oleg spotted that
perf_event_init_context() can loose an error value with the result
that fork() can succeed even though we did not fully inherit the perf
event context.
Spotted-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: oleg@redhat.com
Fixes: 889ff0150661 ("perf/core: Split context's event group list into pinned and non-pinned lists")
Link: http://lkml.kernel.org/r/20170316125823.190342547@infradead.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
kernel/events/core.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 76e26b8..5a550f2 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7470,7 +7470,7 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
ret = inherit_task_group(event, parent, parent_ctx,
child, ctxn, &inherited_all);
if (ret)
- break;
+ goto out_unlock;
}
/*
@@ -7486,7 +7486,7 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
ret = inherit_task_group(event, parent, parent_ctx,
child, ctxn, &inherited_all);
if (ret)
- break;
+ goto out_unlock;
}
raw_spin_lock_irqsave(&parent_ctx->lock, flags);
@@ -7514,6 +7514,7 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
}
raw_spin_unlock_irqrestore(&parent_ctx->lock, flags);
+out_unlock:
mutex_unlock(&parent_ctx->mutex);
perf_unpin_context(parent_ctx);
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:40 +0200 |
| Subject | [PATCH 3.10 211/250] powerpc: Disable HFSCR[TM] if TM is not supported |
| Message-ID | <tPSIt-4Pr-79@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
commit 7ed23e1bae8bf7e37fd555066550a00b95a3a98b upstream.
On Power8 & Power9 the early CPU inititialisation in __init_HFSCR()
turns on HFSCR[TM] (Hypervisor Facility Status and Control Register
[Transactional Memory]), but that doesn't take into account that TM
might be disabled by CPU features, or disabled by the kernel being built
with CONFIG_PPC_TRANSACTIONAL_MEM=n.
So later in boot, when we have setup the CPU features, clear HSCR[TM] if
the TM CPU feature has been disabled. We use CPU_FTR_TM_COMP to account
for the CONFIG_PPC_TRANSACTIONAL_MEM=n case.
Without this a KVM guest might try use TM, even if told not to, and
cause an oops in the host kernel. Typically the oops is seen in
__kvmppc_vcore_entry() and may or may not be fatal to the host, but is
always bad news.
In practice all shipping CPU revisions do support TM, and all host
kernels we are aware of build with TM support enabled, so no one should
actually be able to hit this in the wild.
Fixes: 2a3563b023e5 ("powerpc: Setup in HFSCR for POWER8")
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Tested-by: Sam Bobroff <sam.bobroff@au1.ibm.com>
[mpe: Rewrite change log with input from Sam, add Fixes/stable]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
[sb: Backported to linux-4.4.y: adjusted context]
Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
arch/powerpc/kernel/setup_64.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 389fb807..1d3d3d6 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -142,6 +142,15 @@ static void check_smt_enabled(void)
of_node_put(dn);
}
}
+
+ /*
+ * Fixup HFSCR:TM based on CPU features. The bit is set by our
+ * early asm init because at that point we haven't updated our
+ * CPU features from firmware and device-tree. Here we have,
+ * so let's do it.
+ */
+ if (cpu_has_feature(CPU_FTR_HVMODE) && !cpu_has_feature(CPU_FTR_TM_COMP))
+ mtspr(SPRN_HFSCR, mfspr(SPRN_HFSCR) & ~HFSCR_TM);
}
/* Look for smt-enabled= cmdline option */
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:40 +0200 |
| Subject | [PATCH 3.10 192/250] ALSA: ctxfi: Fallback DMA mask to 32bit |
| Message-ID | <tPSIt-4Pr-81@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Takashi Iwai <tiwai@suse.de>
commit 15c75b09f8d190f89ab4db463b87d411ca349dfe upstream.
Currently ctxfi driver tries to set only the 64bit DMA mask on 64bit
architectures, and bails out if it fails. This causes a problem on
some platforms since the 64bit DMA isn't always guaranteed. We should
fall back to the default 32bit DMA when 64bit DMA fails.
Fixes: 6d74b86d3c0f ("ALSA: ctxfi - Allow 64bit DMA")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
sound/pci/ctxfi/cthw20k1.c | 19 ++++++-------------
sound/pci/ctxfi/cthw20k2.c | 18 ++++++------------
2 files changed, 12 insertions(+), 25 deletions(-)
diff --git a/sound/pci/ctxfi/cthw20k1.c b/sound/pci/ctxfi/cthw20k1.c
index 6ac40be..abd0a2d 100644
--- a/sound/pci/ctxfi/cthw20k1.c
+++ b/sound/pci/ctxfi/cthw20k1.c
@@ -27,12 +27,6 @@
#include "cthw20k1.h"
#include "ct20k1reg.h"
-#if BITS_PER_LONG == 32
-#define CT_XFI_DMA_MASK DMA_BIT_MASK(32) /* 32 bit PTE */
-#else
-#define CT_XFI_DMA_MASK DMA_BIT_MASK(64) /* 64 bit PTE */
-#endif
-
struct hw20k1 {
struct hw hw;
spinlock_t reg_20k1_lock;
@@ -1903,19 +1897,18 @@ static int hw_card_start(struct hw *hw)
{
int err;
struct pci_dev *pci = hw->pci;
+ const unsigned int dma_bits = BITS_PER_LONG;
err = pci_enable_device(pci);
if (err < 0)
return err;
/* Set DMA transfer mask */
- if (pci_set_dma_mask(pci, CT_XFI_DMA_MASK) < 0 ||
- pci_set_consistent_dma_mask(pci, CT_XFI_DMA_MASK) < 0) {
- printk(KERN_ERR "architecture does not support PCI "
- "busmaster DMA with mask 0x%llx\n",
- CT_XFI_DMA_MASK);
- err = -ENXIO;
- goto error1;
+ if (dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
+ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits));
+ } else {
+ dma_set_mask(&pci->dev, DMA_BIT_MASK(32));
+ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(32));
}
if (!hw->io_base) {
diff --git a/sound/pci/ctxfi/cthw20k2.c b/sound/pci/ctxfi/cthw20k2.c
index b143886..5828a3e 100644
--- a/sound/pci/ctxfi/cthw20k2.c
+++ b/sound/pci/ctxfi/cthw20k2.c
@@ -26,12 +26,6 @@
#include "cthw20k2.h"
#include "ct20k2reg.h"
-#if BITS_PER_LONG == 32
-#define CT_XFI_DMA_MASK DMA_BIT_MASK(32) /* 32 bit PTE */
-#else
-#define CT_XFI_DMA_MASK DMA_BIT_MASK(64) /* 64 bit PTE */
-#endif
-
struct hw20k2 {
struct hw hw;
/* for i2c */
@@ -2026,18 +2020,18 @@ static int hw_card_start(struct hw *hw)
int err = 0;
struct pci_dev *pci = hw->pci;
unsigned int gctl;
+ const unsigned int dma_bits = BITS_PER_LONG;
err = pci_enable_device(pci);
if (err < 0)
return err;
/* Set DMA transfer mask */
- if (pci_set_dma_mask(pci, CT_XFI_DMA_MASK) < 0 ||
- pci_set_consistent_dma_mask(pci, CT_XFI_DMA_MASK) < 0) {
- printk(KERN_ERR "ctxfi: architecture does not support PCI "
- "busmaster DMA with mask 0x%llx\n", CT_XFI_DMA_MASK);
- err = -ENXIO;
- goto error1;
+ if (!dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) {
+ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits));
+ } else {
+ dma_set_mask(&pci->dev, DMA_BIT_MASK(32));
+ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(32));
}
if (!hw->io_base) {
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:40 +0200 |
| Subject | [PATCH 3.10 232/250] Drivers: hv: avoid vfree() on crash |
| Message-ID | <tPSIt-4Pr-83@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Vitaly Kuznetsov <vkuznets@redhat.com>
commit a9f61ca793becabdefab03b77568d6c6f8c1bc79 upstream.
When we crash from NMI context (e.g. after NMI injection from host when
'sysctl -w kernel.unknown_nmi_panic=1' is set) we hit
kernel BUG at mm/vmalloc.c:1530!
as vfree() is denied. While the issue could be solved with in_nmi() check
instead I opted for skipping vfree on all sorts of crashes to reduce the
amount of work which can cause consequent crashes. We don't really need to
free anything on crash.
[js] no tsc and kexec in 3.12 yet
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
drivers/hv/hv.c | 5 +++--
drivers/hv/hyperv_vmbus.h | 2 +-
drivers/hv/vmbus_drv.c | 4 ++--
3 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
index ae49237..b103955 100644
--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -193,7 +193,7 @@ cleanup:
*
* This routine is called normally during driver unloading or exiting.
*/
-void hv_cleanup(void)
+void hv_cleanup(bool crash)
{
union hv_x64_msr_hypercall_contents hypercall_msr;
@@ -203,7 +203,8 @@ void hv_cleanup(void)
if (hv_context.hypercall_page) {
hypercall_msr.as_uint64 = 0;
wrmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64);
- vfree(hv_context.hypercall_page);
+ if (!crash)
+ vfree(hv_context.hypercall_page);
hv_context.hypercall_page = NULL;
}
}
diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
index 12f2f9e..11d4e62 100644
--- a/drivers/hv/hyperv_vmbus.h
+++ b/drivers/hv/hyperv_vmbus.h
@@ -519,7 +519,7 @@ extern struct hv_context hv_context;
extern int hv_init(void);
-extern void hv_cleanup(void);
+extern void hv_cleanup(bool crash);
extern int hv_post_message(union hv_connection_id connection_id,
enum hv_message_type message_type,
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index 80754e2..3190a1f 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -618,7 +618,7 @@ err_unregister:
bus_unregister(&hv_bus);
err_cleanup:
- hv_cleanup();
+ hv_cleanup(false);
return ret;
}
@@ -841,7 +841,7 @@ static void __exit vmbus_exit(void)
free_irq(irq, hv_acpi_dev);
vmbus_free_channels();
bus_unregister(&hv_bus);
- hv_cleanup();
+ hv_cleanup(false);
acpi_bus_unregister_driver(&vmbus_acpi_driver);
hv_cpu_hotplug_quirk(false);
}
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:50 +0200 |
| Subject | [PATCH 3.10 249/250] dccp/tcp: do not inherit mc_list from parent |
| Message-ID | <tPSS5-4Tk-1@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Eric Dumazet <edumazet@google.com>
commit 657831ffc38e30092a2d5f03d385d710eb88b09a upstream.
syzkaller found a way to trigger double frees from ip_mc_drop_socket()
It turns out that leave a copy of parent mc_list at accept() time,
which is very bad.
Very similar to commit 8b485ce69876 ("tcp: do not inherit
fastopen_req from parent")
Initial report from Pray3r, completed by Andrey one.
Thanks a lot to them !
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Pray3r <pray3r.z@gmail.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
net/ipv4/inet_connection_sock.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 6acb541..40ac1e2 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -688,6 +688,8 @@ struct sock *inet_csk_clone_lock(const struct sock *sk,
inet_sk(newsk)->inet_sport = inet_rsk(req)->loc_port;
newsk->sk_write_space = sk_stream_write_space;
+ inet_sk(newsk)->mc_list = NULL;
+
newicsk->icsk_retransmits = 0;
newicsk->icsk_backoff = 0;
newicsk->icsk_probes_out = 0;
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:50 +0200 |
| Subject | [PATCH 3.10 033/250] scsi: zfcp: fix rport unblock race with LUN recovery |
| Message-ID | <tPSS5-4Tk-3@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Steffen Maier <maier@linux.vnet.ibm.com>
commit 6f2ce1c6af37191640ee3ff6e8fc39ea10352f4c upstream.
It is unavoidable that zfcp_scsi_queuecommand() has to finish requests
with DID_IMM_RETRY (like fc_remote_port_chkready()) during the time
window when zfcp detected an unavailable rport but
fc_remote_port_delete(), which is asynchronous via
zfcp_scsi_schedule_rport_block(), has not yet blocked the rport.
However, for the case when the rport becomes available again, we should
prevent unblocking the rport too early. In contrast to other FCP LLDDs,
zfcp has to open each LUN with the FCP channel hardware before it can
send I/O to a LUN. So if a port already has LUNs attached and we
unblock the rport just after port recovery, recoveries of LUNs behind
this port can still be pending which in turn force
zfcp_scsi_queuecommand() to unnecessarily finish requests with
DID_IMM_RETRY.
This also opens a time window with unblocked rport (until the followup
LUN reopen recovery has finished). If a scsi_cmnd timeout occurs during
this time window fc_timed_out() cannot work as desired and such command
would indeed time out and trigger scsi_eh. This prevents a clean and
timely path failover. This should not happen if the path issue can be
recovered on FC transport layer such as path issues involving RSCNs.
Fix this by only calling zfcp_scsi_schedule_rport_register(), to
asynchronously trigger fc_remote_port_add(), after all LUN recoveries as
children of the rport have finished and no new recoveries of equal or
higher order were triggered meanwhile. Finished intentionally includes
any recovery result no matter if successful or failed (still unblock
rport so other successful LUNs work). For simplicity, we check after
each finished LUN recovery if there is another LUN recovery pending on
the same port and then do nothing. We handle the special case of a
successful recovery of a port without LUN children the same way without
changing this case's semantics.
For debugging we introduce 2 new trace records written if the rport
unblock attempt was aborted due to still unfinished or freshly triggered
recovery. The records are only written above the default trace level.
Benjamin noticed the important special case of new recovery that can be
triggered between having given up the erp_lock and before calling
zfcp_erp_action_cleanup() within zfcp_erp_strategy(). We must avoid the
following sequence:
ERP thread rport_work other context
------------------------- -------------- --------------------------------
port is unblocked, rport still blocked,
due to pending/running ERP action,
so ((port->status & ...UNBLOCK) != 0)
and (port->rport == NULL)
unlock ERP
zfcp_erp_action_cleanup()
case ZFCP_ERP_ACTION_REOPEN_LUN:
zfcp_erp_try_rport_unblock()
((status & ...UNBLOCK) != 0) [OLD!]
zfcp_erp_port_reopen()
lock ERP
zfcp_erp_port_block()
port->status clear ...UNBLOCK
unlock ERP
zfcp_scsi_schedule_rport_block()
port->rport_task = RPORT_DEL
queue_work(rport_work)
zfcp_scsi_rport_work()
(port->rport_task != RPORT_ADD)
port->rport_task = RPORT_NONE
zfcp_scsi_rport_block()
if (!port->rport) return
zfcp_scsi_schedule_rport_register()
port->rport_task = RPORT_ADD
queue_work(rport_work)
zfcp_scsi_rport_work()
(port->rport_task == RPORT_ADD)
port->rport_task = RPORT_NONE
zfcp_scsi_rport_register()
(port->rport == NULL)
rport = fc_remote_port_add()
port->rport = rport;
Now the rport was erroneously unblocked while the zfcp_port is blocked.
This is another situation we want to avoid due to scsi_eh
potential. This state would at least remain until the new recovery from
the other context finished successfully, or potentially forever if it
failed. In order to close this race, we take the erp_lock inside
zfcp_erp_try_rport_unblock() when checking the status of zfcp_port or
LUN. With that, the possible corresponding rport state sequences would
be: (unblock[ERP thread],block[other context]) if the ERP thread gets
erp_lock first and still sees ((port->status & ...UNBLOCK) != 0),
(block[other context],NOP[ERP thread]) if the ERP thread gets erp_lock
after the other context has already cleard ...UNBLOCK from port->status.
Since checking fields of struct erp_action is unsafe because they could
have been overwritten (re-used for new recovery) meanwhile, we only
check status of zfcp_port and LUN since these are only changed under
erp_lock elsewhere. Regarding the check of the proper status flags (port
or port_forced are similar to the shown adapter recovery):
[zfcp_erp_adapter_shutdown()]
zfcp_erp_adapter_reopen()
zfcp_erp_adapter_block()
* clear UNBLOCK ---------------------------------------+
zfcp_scsi_schedule_rports_block() |
write_lock_irqsave(&adapter->erp_lock, flags);-------+ |
zfcp_erp_action_enqueue() | |
zfcp_erp_setup_act() | |
* set ERP_INUSE -----------------------------------|--|--+
write_unlock_irqrestore(&adapter->erp_lock, flags);--+ | |
.context-switch. | |
zfcp_erp_thread() | |
zfcp_erp_strategy() | |
write_lock_irqsave(&adapter->erp_lock, flags);------+ | |
... | | |
zfcp_erp_strategy_check_target() | | |
zfcp_erp_strategy_check_adapter() | | |
zfcp_erp_adapter_unblock() | | |
* set UNBLOCK -----------------------------------|--+ |
zfcp_erp_action_dequeue() | |
* clear ERP_INUSE ---------------------------------|-----+
... |
write_unlock_irqrestore(&adapter->erp_lock, flags);-+
Hence, we should check for both UNBLOCK and ERP_INUSE because they are
interleaved. Also we need to explicitly check ERP_FAILED for the link
down case which currently does not clear the UNBLOCK flag in
zfcp_fsf_link_down_info_eval().
Signed-off-by: Steffen Maier <maier@linux.vnet.ibm.com>
Fixes: 8830271c4819 ("[SCSI] zfcp: Dont fail SCSI commands when transitioning to blocked fc_rport")
Fixes: a2fa0aede07c ("[SCSI] zfcp: Block FC transport rports early on errors")
Fixes: 5f852be9e11d ("[SCSI] zfcp: Fix deadlock between zfcp ERP and SCSI")
Fixes: 338151e06608 ("[SCSI] zfcp: make use of fc_remote_port_delete when target port is unavailable")
Fixes: 3859f6a248cb ("[PATCH] zfcp: add rports to enable scsi_add_device to work again")
Reviewed-by: Benjamin Block <bblock@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
drivers/s390/scsi/zfcp_dbf.c | 17 +++++++++---
drivers/s390/scsi/zfcp_erp.c | 61 +++++++++++++++++++++++++++++++++++++++++--
drivers/s390/scsi/zfcp_ext.h | 4 ++-
drivers/s390/scsi/zfcp_scsi.c | 4 +--
4 files changed, 77 insertions(+), 9 deletions(-)
diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
index c846a63..bf13e73 100644
--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -282,11 +282,12 @@ void zfcp_dbf_rec_trig(char *tag, struct zfcp_adapter *adapter,
/**
- * zfcp_dbf_rec_run - trace event related to running recovery
+ * zfcp_dbf_rec_run_lvl - trace event related to running recovery
+ * @level: trace level to be used for event
* @tag: identifier for event
* @erp: erp_action running
*/
-void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp)
+void zfcp_dbf_rec_run_lvl(int level, char *tag, struct zfcp_erp_action *erp)
{
struct zfcp_dbf *dbf = erp->adapter->dbf;
struct zfcp_dbf_rec *rec = &dbf->rec_buf;
@@ -312,11 +313,21 @@ void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp)
else
rec->u.run.rec_count = atomic_read(&erp->adapter->erp_counter);
- debug_event(dbf->rec, 1, rec, sizeof(*rec));
+ debug_event(dbf->rec, level, rec, sizeof(*rec));
spin_unlock_irqrestore(&dbf->rec_lock, flags);
}
/**
+ * zfcp_dbf_rec_run - trace event related to running recovery
+ * @tag: identifier for event
+ * @erp: erp_action running
+ */
+void zfcp_dbf_rec_run(char *tag, struct zfcp_erp_action *erp)
+{
+ zfcp_dbf_rec_run_lvl(1, tag, erp);
+}
+
+/**
* zfcp_dbf_rec_run_wka - trace wka port event with info like running recovery
* @tag: identifier for event
* @wka_port: well known address port
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index b4cd26d..f7e720e 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -3,7 +3,7 @@
*
* Error Recovery Procedures (ERP).
*
- * Copyright IBM Corp. 2002, 2015
+ * Copyright IBM Corp. 2002, 2016
*/
#define KMSG_COMPONENT "zfcp"
@@ -1212,6 +1212,62 @@ static void zfcp_erp_action_dequeue(struct zfcp_erp_action *erp_action)
}
}
+/**
+ * zfcp_erp_try_rport_unblock - unblock rport if no more/new recovery
+ * @port: zfcp_port whose fc_rport we should try to unblock
+ */
+static void zfcp_erp_try_rport_unblock(struct zfcp_port *port)
+{
+ unsigned long flags;
+ struct zfcp_adapter *adapter = port->adapter;
+ int port_status;
+ struct Scsi_Host *shost = adapter->scsi_host;
+ struct scsi_device *sdev;
+
+ write_lock_irqsave(&adapter->erp_lock, flags);
+ port_status = atomic_read(&port->status);
+ if ((port_status & ZFCP_STATUS_COMMON_UNBLOCKED) == 0 ||
+ (port_status & (ZFCP_STATUS_COMMON_ERP_INUSE |
+ ZFCP_STATUS_COMMON_ERP_FAILED)) != 0) {
+ /* new ERP of severity >= port triggered elsewhere meanwhile or
+ * local link down (adapter erp_failed but not clear unblock)
+ */
+ zfcp_dbf_rec_run_lvl(4, "ertru_p", &port->erp_action);
+ write_unlock_irqrestore(&adapter->erp_lock, flags);
+ return;
+ }
+ spin_lock(shost->host_lock);
+ __shost_for_each_device(sdev, shost) {
+ struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev);
+ int lun_status;
+
+ if (zsdev->port != port)
+ continue;
+ /* LUN under port of interest */
+ lun_status = atomic_read(&zsdev->status);
+ if ((lun_status & ZFCP_STATUS_COMMON_ERP_FAILED) != 0)
+ continue; /* unblock rport despite failed LUNs */
+ /* LUN recovery not given up yet [maybe follow-up pending] */
+ if ((lun_status & ZFCP_STATUS_COMMON_UNBLOCKED) == 0 ||
+ (lun_status & ZFCP_STATUS_COMMON_ERP_INUSE) != 0) {
+ /* LUN blocked:
+ * not yet unblocked [LUN recovery pending]
+ * or meanwhile blocked [new LUN recovery triggered]
+ */
+ zfcp_dbf_rec_run_lvl(4, "ertru_l", &zsdev->erp_action);
+ spin_unlock(shost->host_lock);
+ write_unlock_irqrestore(&adapter->erp_lock, flags);
+ return;
+ }
+ }
+ /* now port has no child or all children have completed recovery,
+ * and no ERP of severity >= port was meanwhile triggered elsewhere
+ */
+ zfcp_scsi_schedule_rport_register(port);
+ spin_unlock(shost->host_lock);
+ write_unlock_irqrestore(&adapter->erp_lock, flags);
+}
+
static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
{
struct zfcp_adapter *adapter = act->adapter;
@@ -1222,6 +1278,7 @@ static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
case ZFCP_ERP_ACTION_REOPEN_LUN:
if (!(act->status & ZFCP_STATUS_ERP_NO_REF))
scsi_device_put(sdev);
+ zfcp_erp_try_rport_unblock(port);
break;
case ZFCP_ERP_ACTION_REOPEN_PORT:
@@ -1232,7 +1289,7 @@ static void zfcp_erp_action_cleanup(struct zfcp_erp_action *act, int result)
*/
if (act->step != ZFCP_ERP_STEP_UNINITIALIZED)
if (result == ZFCP_ERP_SUCCEEDED)
- zfcp_scsi_schedule_rport_register(port);
+ zfcp_erp_try_rport_unblock(port);
/* fall through */
case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED:
put_device(&port->dev);
diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
index 01527c3..fdef6a6 100644
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -3,7 +3,7 @@
*
* External function declarations.
*
- * Copyright IBM Corp. 2002, 2015
+ * Copyright IBM Corp. 2002, 2016
*/
#ifndef ZFCP_EXT_H
@@ -49,6 +49,8 @@ extern void zfcp_dbf_adapter_unregister(struct zfcp_adapter *);
extern void zfcp_dbf_rec_trig(char *, struct zfcp_adapter *,
struct zfcp_port *, struct scsi_device *, u8, u8);
extern void zfcp_dbf_rec_run(char *, struct zfcp_erp_action *);
+extern void zfcp_dbf_rec_run_lvl(int level, char *tag,
+ struct zfcp_erp_action *erp);
extern void zfcp_dbf_rec_run_wka(char *, struct zfcp_fc_wka_port *, u64);
extern void zfcp_dbf_hba_fsf_uss(char *, struct zfcp_fsf_req *);
extern void zfcp_dbf_hba_fsf_res(char *, int, struct zfcp_fsf_req *);
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 0bbc2a9..66c37e7 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -109,9 +109,7 @@ int zfcp_scsi_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scpnt)
}
if (unlikely(!(status & ZFCP_STATUS_COMMON_UNBLOCKED))) {
- /* This could be either
- * open LUN pending: this is temporary, will result in
- * open LUN or ERP_FAILED, so retry command
+ /* This could be
* call to rport_delete pending: mimic retry from
* fc_remote_port_chkready until rport is BLOCKED
*/
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:50 +0200 |
| Subject | [PATCH 3.10 171/250] locking/static_keys: Add static_key_{en,dis}able() helpers |
| Message-ID | <tPSS5-4Tk-5@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Peter Zijlstra <peterz@infradead.org>
commit e33886b38cc82a9fc3b2d655dfc7f50467594138 upstream.
Add two helpers to make it easier to treat the refcount as boolean.
[js] do not involve WARN_ON_ONCE as it causes build failures
Suggested-by: Jason Baron <jasonbaron0@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
[wt: only backported for use in next fix ;
s/static_key_count(key)/atomic_read(&key->enabled)/]
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
include/linux/jump_label.h | 16 ++++++++++++++++
kernel/sched/core.c | 6 ++----
2 files changed, 18 insertions(+), 4 deletions(-)
diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
index 0976fc4..7f831b2 100644
--- a/include/linux/jump_label.h
+++ b/include/linux/jump_label.h
@@ -208,4 +208,20 @@ static inline bool static_key_enabled(struct static_key *key)
return (atomic_read(&key->enabled) > 0);
}
+static inline void static_key_enable(struct static_key *key)
+{
+ int count = atomic_read(&key->enabled);
+
+ if (!count)
+ static_key_slow_inc(key);
+}
+
+static inline void static_key_disable(struct static_key *key)
+{
+ int count = atomic_read(&key->enabled);
+
+ if (count)
+ static_key_slow_dec(key);
+}
+
#endif /* _LINUX_JUMP_LABEL_H */
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 6a366f9..506e56e 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -179,14 +179,12 @@ struct static_key sched_feat_keys[__SCHED_FEAT_NR] = {
static void sched_feat_disable(int i)
{
- if (static_key_enabled(&sched_feat_keys[i]))
- static_key_slow_dec(&sched_feat_keys[i]);
+ static_key_disable(&sched_feat_keys[i]);
}
static void sched_feat_enable(int i)
{
- if (!static_key_enabled(&sched_feat_keys[i]))
- static_key_slow_inc(&sched_feat_keys[i]);
+ static_key_enable(&sched_feat_keys[i]);
}
#else
static void sched_feat_disable(int i) { };
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:50 +0200 |
| Subject | [PATCH 3.10 096/250] svcrpc: don't leak contexts on PROC_DESTROY |
| Message-ID | <tPSS5-4Tk-9@gated-at.bofh.it> |
| In reply to | #1660349 |
From: "J. Bruce Fields" <bfields@redhat.com> commit 78794d1890708cf94e3961261e52dcec2cc34722 upstream. Context expiry times are in units of seconds since boot, not unix time. The use of get_seconds() here therefore sets the expiry time decades in the future. This prevents timely freeing of contexts destroyed by client RPC_GSS_PROC_DESTROY requests. We'd still free them eventually (when the module is unloaded or the container shut down), but a lot of contexts could pile up before then. Fixes: c5b29f885afe "sunrpc: use seconds since boot in expiry cache" Reported-by: Andy Adamson <andros@netapp.com> Signed-off-by: J. Bruce Fields <bfields@redhat.com> Signed-off-by: Willy Tarreau <w@1wt.eu> --- net/sunrpc/auth_gss/svcauth_gss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c index 62663a0..e625efe 100644 --- a/net/sunrpc/auth_gss/svcauth_gss.c +++ b/net/sunrpc/auth_gss/svcauth_gss.c @@ -1518,7 +1518,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp) case RPC_GSS_PROC_DESTROY: if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq)) goto auth_err; - rsci->h.expiry_time = get_seconds(); + rsci->h.expiry_time = seconds_since_boot(); set_bit(CACHE_NEGATIVE, &rsci->h.flags); if (resv->iov_len + 4 > PAGE_SIZE) goto drop; -- 2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:50 +0200 |
| Subject | [PATCH 3.10 055/250] USB: serial: mos7720: fix use-after-free on probe errors |
| Message-ID | <tPSS5-4Tk-7@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Johan Hovold <johan@kernel.org>
commit 91a1ff4d53c5184d383d0baeeaeab6f9736f2ff3 upstream.
The interrupt URB was submitted on probe but never stopped on probe
errors. This can lead to use-after-free issues in the completion
handler when accessing the freed usb-serial struct:
Unable to handle kernel paging request at virtual address 6b6b6be7
...
[<bf052e70>] (mos7715_interrupt_callback [mos7720]) from [<c052a894>] (__usb_hcd_giveback_urb+0x80/0x140)
[<c052a894>] (__usb_hcd_giveback_urb) from [<c052a9a4>] (usb_hcd_giveback_urb+0x50/0x138)
[<c052a9a4>] (usb_hcd_giveback_urb) from [<c0550684>] (musb_giveback+0xc8/0x1cc)
Fixes: b69578df7e98 ("USB: usbserial: mos7720: add support for parallel port on moschip 7715")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
drivers/usb/serial/mos7720.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 44936c6..6c19dbb 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -1962,8 +1962,10 @@ static int mos7720_startup(struct usb_serial *serial)
#ifdef CONFIG_USB_SERIAL_MOS7715_PARPORT
if (product == MOSCHIP_DEVICE_ID_7715) {
ret_val = mos7715_parport_init(serial);
- if (ret_val < 0)
+ if (ret_val < 0) {
+ usb_kill_urb(serial->port[0]->interrupt_in_urb);
return ret_val;
+ }
}
#endif
/* LSR For Port 1 */
@@ -1975,6 +1977,8 @@ static int mos7720_startup(struct usb_serial *serial)
static void mos7720_release(struct usb_serial *serial)
{
+ usb_kill_urb(serial->port[0]->interrupt_in_urb);
+
#ifdef CONFIG_USB_SERIAL_MOS7715_PARPORT
/* close the parallel port */
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2017-06-08 01:50 +0200 |
| Subject | [PATCH 3.10 125/250] net: socket: fix recvmmsg not returning error from sock_error |
| Message-ID | <tPSS6-4Tk-15@gated-at.bofh.it> |
| In reply to | #1660349 |
From: Maxime Jayat <maxime.jayat@mobile-devices.fr>
commit e623a9e9dec29ae811d11f83d0074ba254aba374 upstream.
Commit 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path"),
changed the exit path of recvmmsg to always return the datagrams
variable and modified the error paths to set the variable to the error
code returned by recvmsg if necessary.
However in the case sock_error returned an error, the error code was
then ignored, and recvmmsg returned 0.
Change the error path of recvmmsg to correctly return the error code
of sock_error.
The bug was triggered by using recvmmsg on a CAN interface which was
not up. Linux 4.6 and later return 0 in this case while earlier
releases returned -ENETDOWN.
Fixes: 34b88a68f26a ("net: Fix use after free in the recvmmsg exit path")
Signed-off-by: Maxime Jayat <maxime.jayat@mobile-devices.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
net/socket.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/socket.c b/net/socket.c
index e91e8ed..773ba3a 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2326,8 +2326,10 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
return err;
err = sock_error(sock->sk);
- if (err)
+ if (err) {
+ datagrams = err;
goto out_put;
+ }
entry = mmsg;
compat_entry = (struct compat_mmsghdr __user *)mmsg;
--
2.8.0.rc2.1.gbe9624a
[toc] | [prev] | [next] | [standalone]
Page 5 of 11 — ← Prev page 1 … 3 4 [5] 6 7 … 11 Next page →
Back to top | Article view | linux.kernel
csiph-web